EUVD-2026-56819Severity by source
Sources disagree (Medium–Critical)CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated TURN session (PR:L) and non-prefix-aligned IPv6 denied range (AC:H); scope change to internal systems reached via relay (S:C/C:H/I:H); no direct availability impact on coturn itself.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.
AnalysisAI
IPv6 denied-peer-ip bypass in Coturn before 4.16.0 allows an authenticated TURN client to relay traffic to internal IPv6 hosts that fall within a configured blocked range, enabling a TURN-specific server-side request forgery. The root cause is a component-wise (rectangular-box) comparison in addr_less_eq() that fails to enforce the contiguous numerical span [min,max] for non-prefix-aligned IPv6 ranges, so addresses like 2001:db8::1ff are incorrectly classified as outside a denied range of 2001:db8::100-2001:db8::200. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker possesses valid TURN credentials for the target Coturn server (PR:L - authenticated session required); (2) the server is configured with at least one native IPv6 denied-peer-ip range that is not prefix-aligned - meaning the lower bytes of the range boundary addresses are non-zero, creating gaps in the component-wise comparison (e.g., denied-peer-ip=2001:db8::100-2001:db8::200 is vulnerable; denied-peer-ip=2001:db8::/32 is not); and (3) the target internal IPv6 address is numerically within the intended denied span but falls outside the per-byte rectangular box (e.g., has a higher value in a lower-significance byte while a higher-significance byte is still below the maximum boundary). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, SC:H/SI:H/SA:H, score 5.8) indicates network-reachable exploitation with low privilege and no user interaction, but the AT:P (Attack Requirements: Present) modifier correctly captures that the server must be configured with at least one non-prefix-aligned IPv6 denied-peer-ip range - a specific, non-default deployment pattern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated WebRTC or SIP user holding valid TURN credentials sends an Allocate or CreatePermission request targeting an internal IPv6 address such as 2001:db8::1ff, which falls within the operator's configured denied-peer-ip range of 2001:db8::100-2001:db8::200 but is misclassified as outside it due to the byte-wise comparison bug. Coturn permits the relay, allowing the attacker to tunnel arbitrary UDP or TCP traffic through the TURN server to the internal IPv6 host - effectively using the TURN relay as an SSRF pivot to reach internal DNS resolvers, databases, or management interfaces. … |
| Remediation | Upgrade Coturn to version 4.16.0, which replaces the component-wise byte loop in addr_less_eq() with a memcmp()-based lexicographic comparison, correctly enforcing contiguous IPv6 denied-peer-ip spans. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today